ssh_exchange_identification: Connection closed by remote host

[Ahmed_58]

Dear all,
I'm trying sftp for first time, i try one server it is working, but another server is not working from the same server, gettting below message;
---------------------------------------
batmed1:/>sftp telegram@bat-bcdr
Connecting to bat-bcdr...
ssh_exchange_identification: Connection closed by remote host
Connection closed
----------------------------------------

I try this command to see more detail...
-------------------------------------------
batmed1:/>ssh -vvv telegram@bat-bcdr
OpenSSH_4.4p1-hpn12v11, OpenSSL 0.9.7l 28 Sep 2006
HP-UX Secure Shell-A.04.40.005, HP-UX Secure Shell version
debug1: Reading configuration data /opt/ssh/etc/ssh_config
debug3: Seeding PRNG from /opt/ssh/libexec/ssh-rand-helper
debug2: ssh_connect: needpriv 0
debug1: Connecting to bat-bcdr [10.40.3.46] port 22.
debug1: Connection established.
debug1: permanently_set_uid: 0/3
debug1: identity file /.ssh/id_rsa type -1
debug1: identity file /.ssh/id_dsa type -1
ssh_exchange_identification: Connection closed by remote host
-----------------------------------------------
below shows the syslog.log in the destination server
------------------------------------------
bat-bcdr sshd[8139]: fatal: buffer_get_int: buffer error
May 7 14:06:47 bat-bcdr named[1158]: zone 64.168.192.IN-ADDR.ARPA/IN: refresh: failure trying master 10.30.3.88#53: timed out
------------------------------------------

Your help appreceiated...
Ahmed

[Ivan Krastev]

Try to disable DNS back resolv on ssh server - in sshd_config edit "UseDNS no" and restart ssh server.

regards,
ivan

[Redhat · Accepted solution]

Simply check by scp some file first between the servers. if failing -->

you may need to check your ssh pub key .

match the output of #cat id_dsa.pub with the autorization.key of the other server.

look in .ssh folder.

in worst case regenare the key by
#ssh-keygen -t dsa

and copy the public key to the authorization key of the other server.

[Ahmed_58]

I try another server, I'm getting ...
-------------
batmed1:/>sftp cduser@bat-bbis
Connecting to bat-bbis...
The authenticity of host 'bat-bbis (10.3.4.11)' can't be established.
RSA key fingerprint is e4:06:ce:24:b0:06:5d:0b:55:c0:4f:5d:c3:49:a9:16.
Are you sure you want to continue connecting (yes/no)?
----------------
What I should reply?

[Ahmed_58]

I can see two files in .ssh folder, is this two files (known_hosts & prng_seed) should be exists on the other servers?

[Safarali]

Ahmed you have to type yes now then ssh connection will established next time it wont happen


Regards
Safar

[Ahmed_58]

hi again,
now I can see it is working other way round e.g send file from serverB to serverA but not serverA to serverB!

help please.

[Jeeshan]

Hi Ahmed

Is there any tcpwrapper or firewall applied in serverB?

[Ahmed_58]

hi ahsan,
NO. now I regenerate the key I can send files from serverB to serverA but not other way round.

Ahmed

[Jeeshan]

Hi again

I would suspect problems in OpenSSL's libcrypto or corrupt keys.
Try reading the private key directly with OpenSSL:
$ openssl rsa -noout -check -in id_rsa

[Ahmed_58]

hi ahsan,

the command display ... is it -id_dsa or -id_rsa? for id_dsa below display

# /opt/wbem/sbin/openssl rsa -noout -check -in id_dsa
28823:error:0607907F:digital envelope routines:EVP_PKEY_get1_RSA:expecting an rsa key:p_lib.c:221:

[Jeeshan]

and i have also seen that in your syslog output that,

>>May 7 14:06:47 bat-bcdr named[1158]: zone 64.168.192.IN-ADDR.ARPA/IN: refresh: failure trying master 10.30.3.88#53: timed out

did you check in your DNS entry? it says it doesn't reach the 10.30.3.88. is the serverB address that IP?